Bunkerity BunkerWeb up to 1.6.12 Blacklist blacklist.lua incomplete blacklist

Summaryinfo

A vulnerability identified as very critical has been detected in Bunkerity BunkerWeb up to 1.6.12. Affected is an unknown function of the file src/common/core/blacklist/blacklist.lua of the component Blacklist. Performing a manipulation results in incomplete blacklist. This vulnerability was named CVE-2026-75514. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Bunkerity BunkerWeb up to 1.6.12. This affects some unknown functionality of the file src/common/core/blacklist/blacklist.lua of the component Blacklist. The manipulation with an unknown input leads to a incomplete blacklist vulnerability. CWE is classifying the issue as CWE-184. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-75514 since 08/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/20/2026). The attack technique deployed by this issue is T1562.006 according to MITRE ATT&CK.

Upgrading to version 1.6.13 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Bunkerity

Name

• BunkerWeb

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12

Website

• Product: https://github.com/bunkerity/bunkerweb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion